PenTest – Trust – Relationship

• One-way
• Domain B trusts A
• Users in Domain A can access resources in Domain B
• Users in Domain B cannot access resources in Domain A
• Two-way
• Domain A trusts Domain B
• Domain B trusts Domain A
• Authentication requests can be passed between the two domains in both directions

Enumerate trusts between domains

• Native nltest

  nltest /trusted_domains
  

• PowerShell GetAllTrustRelationships

  ([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()
  
  SourceName          TargetName                    TrustType      TrustDirection
  ----------          ----------                    ---------      --------------
  domainA.local      domainB.local                  TreeRoot       Bidirectional
  

• Crackmapexec module enum_trusts

  cme ldap <ip> -u <user> -p <pass> -M enum_trusts 
  

Exploit trusts between domains

 Require a Domain-Admin level access to the current domain.

References

• External Trusts Are Evil – 14 March 2023 – Charlie Clark (@exploitph)
• Carlos Garcia – Rooted2019 – Pentesting Active Directory Forests public.pdf